NCSC_MAR-Smooth-Operator.pdf (502 KB)

NCSC's malware analysis describes Smooth Operator as macOS malware distributed through the 3CX supply-chain compromise in signed and notarized 3CX Desktop App packages. A malicious libffmpeg.dylib component downloaded and ran a second-stage payload on Intel x86_64 macOS systems, while the report says the ARM slice showed no added malicious code. Smooth Operator generated a UUID-format victim ID, used files under the 3CX application-support directory for state and locking, slept before beaconing, randomly selected from multiple C2 servers, and used HTTPS plus a custom encoding algorithm to obfuscate exfiltrated victim data. The excerpt supports technical detection context through listed hashes for the trojanized DMG, first-stage component, and second-stage payload, but it does not itself attribute the activity to a DPRK actor.